Detection rules › Splunk
Print Spooler Adding A Printer Driver
The following analytic detects the addition of new printer drivers by monitoring Windows PrintService operational logs, specifically EventCode 316. This detection leverages log data to identify messages indicating the addition or update of printer drivers, such as "kernelbase.dll" and "UNIDRV.DLL." This activity is significant as it may indicate exploitation attempts related to vulnerabilities like CVE-2021-34527 (PrintNightmare). If confirmed malicious, attackers could gain code execution or escalate privileges, potentially compromising the affected system. Immediate isolation and investigation of the endpoint are recommended.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1547.012 Boot or Logon Autostart Execution: Print Processors |
| Privilege Escalation | T1547.012 Boot or Logon Autostart Execution: Print Processors |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| PrintService | 316 | Printer driver param1 for param2 param3 was added or updated. |
Stages and Predicates
Stage 1: search
search EventCode=316 Message="*.DLL.*" Message="*UNIDRV.DLL,*" Message="*kernelbase.dll,*" category="Adding a printer driver"
Stage 2: stats
stats BY OpCode, EventCode, ComputerName, Message
Stage 3: search
search
Stage 4: search
search
Stage 5: search
search `macro`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Message | eq |
|
category | eq |
|